Vendor Access: Addressing the Security Challenge with Urgency

The coronavirus pandemic has forced thousands of companies to make leaps in their digital transformation journey. Businesses and public sector agencies were already challenged by remote access, BYOD, and cloud adoption. Now, the coronavirus has raised the stakes. Almost everyone I know that’s working is doing so using remote access because of COVID-19 social distancing and/or stay at home guidelines and orders.

Teleworking is putting great strain on remote access systems. Most likely, you’ve experienced slow connections, crashing websites, or sketchy videoconferences. What’s not so obvious to everyone are the risks of continuing to use Virtual Private Networks (VPNs) for privileged remote administration, especially by vendors. Even before the pandemic, third-part access risk had increasingly become one of the core cybersecurity challenges of our time. Many organizations may now be relying even more heavily on IT service providers to help them adapt to the new work environment. Additionally, many of those service providers may themselves be having to adapt their own operations, potentially making the vendor systems less secure.

Third-Party Risk & VPNs

The vendor, or third party, attack vector has been well-understood since at least the time of Target’s 2013 credit card data breach. That breach was infamously perpetrated by an attacker who gained initial access to the network via a third-party vendor’s VPN account used for monitoring HVAC equipment in stores. Vendor access security risk has exploded since that time. The 2019 Privileged Access Threat Report disclosed that, on average, organizations have 182 vendors logging into their systems every week! A Ponemon Institute survey revealed that 59% of companies experienced a breach due to third parties in 2018. Now is the time for organizations to improve their ability to manage third party risk.

One of the most common tools for remote access – the VPN – is unfit for the purpose of managing privileged vendor remote administration of business systems, whether as part of a staff augmentation use case or just for troubleshooting purposes. Among its security deficiencies, the VPN:

Creates a full tunnel, potentially leaving core systems with no inherent resistance to a compromised edge device or account
Punches big holes in the network segmentation model
Lacks privileged access management (PAM) features

Expanding PAM: A Better Solution

Vendor remote privileged access is a high-risk use case. An attacker could exploit weaknesses in vendor access security to gain access to a sensitive asset (such as a customer database) directly, or move laterally through the network to gain access. In the wake of COVID-19, customers are opening more remote access to business applications and may find themselves more vulnerable than usual.

This creates a compelling argument to expand PAM systems normally used for mission-critical servers in the data center to also cover a broader set of use cases. These expanded PAM systems must:

Work across customers’ hybrid, multi-cloud environments
Enable interoperable authentication and identity management with systems in third party partner environments
Integrate with cloud-native identity and access management (IAM)
Support just-in-time access privileges rather than static accounts